# no\_log will not always hide sensitive data

**URL:** <https://forum.ansible.com/t/no-log-will-not-always-hide-sensitive-data/16966>\
**Category:** Ansible Project\
**Created:** [December 4, 2014, 11:54pm UTC](https://forum.ansible.com/t/no-log-will-not-always-hide-sensitive-data/16966 "2014-12-04T23:54:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frederic\_Lemay](https://avatars.discourse-cdn.com/v4/letter/f/da6949/32.png) [@Frederic\_Lemay](https://forum.ansible.com/u/Frederic_Lemay)\
**Post date:** [December 4, 2014, 11:54pm UTC](https://forum.ansible.com/t/no-log-will-not-always-hide-sensitive-data/16966/1 "2014-12-04T23:54:04Z")

</div>

Hi,

Sometimes playbooks need sensitive information like username/password and you may want to hide it from your log. So you can use the no\_log feature and in most cases, it works. However, using it with with\_items does not.

The following simple example demonstrates it.

Ansible version 1.8.1:

\*test.yml\*

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [December 5, 2014, 12:35am UTC](https://forum.ansible.com/t/no-log-will-not-always-hide-sensitive-data/16966/2 "2014-12-05T00:35:50Z")

</div>

yeah it’s important for debug that we show the loop counter of the item, so we don’t hide that with no\_log. I think most times people would want to see what task is exec’ing in the loop - there could be hundreds.

Now, here’s the trick I was alluding to on Twitter:

in group\_vars/foo or wherever, assume a vault-encrypted file:

user\_details:  
timmy:  
username: timmy  
password: foo  
jimmy:  
username: jimmy  
password: bar

And in your playbook:

- shell: some task … {{ user\_details[item][password] }} …  
with\_items: user\_names  
no\_log: True

And this way it will print the name on each loop indicator, but not the details that you don’t want to show

There are a couple of other ways to do this, the main trick is just don’t loop over the sensitive items. I believe we have a keys() filter to use or there’s one in stock Jinja that makes this easier as well.

---

<div class="post-metadata">

**Author:** ![Vikas\_Kumar](https://avatars.discourse-cdn.com/v4/letter/v/ecb155/32.png) [@Vikas\_Kumar](https://forum.ansible.com/u/Vikas_Kumar)\
**Post date:** [March 10, 2016, 6:06am UTC](https://forum.ansible.com/t/no-log-will-not-always-hide-sensitive-data/16966/3 "2016-03-10T06:06:12Z")

</div>

Looks like this has been fixed in v2.0, I can use _with\_item_ with _no\_log: True_